CVE-2026-49017

Katalog CVE

CVSS 6.5 · Medium EPSS 0,36%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada openstack swift. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

In OpenStack Swift before 2.36.2 and 2.37.2, s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request body. The StreamingInput class repeatedly appends an empty buffer and re-reads, causing the proxy-server worker handling the request to become permanently unresponsive with increasing CPU and memory consumption. An authenticated attacker can systematically exhaust all proxy-server workers, resulting in denial of service. The defect was introduced in Swift 2.36.0.

Rincian

Terbit di NVD

27 Mei 2026

Terakhir diubah

24 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,36% peluang dieksploitasi; lebih tinggi dari 27,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugs.launchpad.net/bugs/2152205 issue tracking · advisory vendor
• https://review.opendev.org/c/openstack/swift/+/987957 issue tracking · patch
• https://review.opendev.org/c/openstack/swift/+/988093 issue tracking · patch
• http://www.openwall.com/lists/oss-security/2026/05/27/9 mailing list · patch · advisory pihak ketiga
• http://www.openwall.com/lists/oss-security/2026/06/02/6 mailing list · patch · advisory pihak ketiga